Sable Index

[RANSOMWARE] CISA Confirms SharePoint Flaw Is Fueling Ransomware Attacks CISA says ransomware gangs are now exploiting a SharePoint Server flaw that lets attackers run code on unpatched systems. More than 200 internet-exposed servers remained vulnerable when checked by Shadowserver. The flaw can be exploited with low privileges and little complexity. @SableIndex | @SableIndexDiscussion

[BREACH] Mozilla Replaces Firefox Signing Key After GitHub Exposure Mozilla replaced the GPG key used to verify some Firefox and Thunderbird releases after an unencrypted copy was committed to a private GitHub repository. Linux users who installed Firefox through RPM packages should run system updates; most users need no action. Mozilla revoked the old key and found no evidence of unauthorized access. The exposed key signed Linux tarballs, RPM packages and checksum files - not standard browser updates. @SableIndex | @SableIndexDiscussion

[BREACH] BdThemes WordPress Plugins Create Hidden Admins After Supply-Chain Hack Researchers say attackers compromised BdThemes’ update infrastructure and used malicious code to create rogue administrator accounts on WordPress sites. The Element Pack plugin has over 100,000 active installs. The plugins were pulled from WordPress.org on Aug. 8. The injected code could install a webshell without requiring a plugin update or user click. @SableIndex | @SableIndexDiscussion

[CRIME] Com Member Sentenced After Sextortion of Nearly 120 Victims A member of “The Com” was sentenced to two years in prison after blackmailing and sexually extorting nearly 120 victims worldwide. The victims included children and teenagers. The case shows how online coercion has become organized cybercrime, not just isolated harassment. @SableIndex | @SableIndexDiscussion

[DEVELOPING · RANSOMWARE] CISA Warns Gunra Ransomware Now Targets Global Organizations CISA, FBI and partners issued a new warning today about Gunra, a ransomware service used by affiliates across the Americas, Europe, Middle East, Africa and Asia-Pacific. Gunra encrypts files, steals data, then threatens to publish it. Investigators say attackers often move from a compromised VPN to the wider network within days. @SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Valve Warns Steam Hardware Buyers After Logistics Hack Valve began notifying Steam hardware customers today that a cyberattack at shipping partner CEVA exposed names, addresses, phone numbers, emails, and order details. Attackers accessed CEVA systems from July 29 to Aug 1; Valve says passwords, Steam Guard codes, and payment data were not exposed. The stolen delivery data can make phishing look genuine. @SableIndex | @SableIndexDiscussion

[MALWARE] Kimsuky Uses Local AI to Sharpen Phishing Attacks A North Korean group is using local AI to sharpen phishing; finance-themed ZIP attachments can hide Windows shortcuts that launch PowerShell malware. Genians identified the group as Kimsuky in an Aug. 9 report, saying local LLMs help process stolen documents and scale lures. It found Ollama, GPT4All and Msty, plus Git-hosted AsyncRAT payloads. @SableIndex | @SableIndexDiscussion

[DEVELOPING · BREACH] Report Says Coinsbuy Wallets Emptied Across Two Chains A report says wallets linked to Coinsbuy were emptied around 13:00 UTC; the total exceeds $7.9M. If you use Coinsbuy, wait before making a transfer; check balances and activity. Dark Web Informer attributed the claim to analyst SpecterAnalyst, who linked transfers through several exchanges toward Monero, a privacy-focused coin. Deposits and withdrawals were paused after the incident and later restored, according to the report. Coinsbuy’s news page showed no incident notice. @SableIndex | @SableIndexDiscussion

[MALWARE] Fake Odyssey Downloads Hide Password-Stealing Malware Bitdefender found fake Windows copies of The Odyssey carrying Lumma Stealer that can steal passwords, payment data, browser sessions and crypto wallets. If a movie download asks you to run an .exe, stop - a video file should not need an installer. The campaign uses “1080p WEBRip” and “Blu-ray” filenames, VLC-like icons and hidden .exe extensions to look harmless. Stolen session cookies can let criminals enter accounts even when MFA is enabled. @SableIndex | @SableIndexDiscussion

[FRAUD] Fake Jury-Duty Calls Drain Florida Family of $25,000 Scammers posing as sheriff’s deputies told a Florida woman she had missed jury duty and faced arrest unless she paid. The callers used real personal details, spoofed caller ID and fake warrants, then kept her on the phone for hours. WSJ reports the family ultimately lost $25,000 in cryptocurrency. @SableIndex | @SableIndexDiscussion

[FRAUD] WhatsApp “Hello” Lured an Accountant Into a $2.5M Crypto Scam Police arrested a BJP leader after tracing ₹50 lakh in a scam that allegedly cost a 70-year-old accountant ₹21.06 crore. A WhatsApp contact led him to a fake trading platform, allowed one withdrawal, showed profits above ₹33 crore, then demanded fees. He made 106 transfers to 76 accounts; police found 15 laundering layers and froze about ₹2 crore. @SableIndex | @SableIndexDiscussion

[BREACH] Framework Warns Customers After Metabase Breach Exposes Contact Data Framework said hackers stole customers’ names, email addresses, phone numbers and physical addresses through a Metabase attack. Framework notified every customer and said payment information was not included. Metabase said attackers used an unknown flaw a zero-day to access its cloud service. @SableIndex | @SableIndexDiscussion

[MALWARE] Fake CAPTCHA Tricks Mac Users Into Installing Wallet-Stealing Malware Fake CAPTCHA pages trick Mac users into pasting a Terminal command that starts a password- and wallet-stealing infection.

- The fake CAPTCHA is not a test. It asks the victim to run the malware manually. - The command downloads a script, profiles the Mac and fetches a version built for its processor. - It steals browser passwords, can prompt for the Mac password, and can drain wallets.

@SableIndex | @SableIndexDiscussion

[DEVELOPING · MALWARE] Suisun City Shuts Down Network After Malware Disrupts 911 Suisun City shut down the IT network after malware disrupted 911 routing, police and fire dispatch at 05:45 on 7 August. Emergency calls were rerouted through Solano County; police and firefighters kept responding while online services and internal operations went offline. The city council declared a state of emergency on Saturday. The FBI, Homeland Security and California emergency officials are investigating. @SableIndex | @SableIndexDiscussion

[FRAUD] Trezor User Loses $7 Million in Seed-phrase Phishing Scam A crypto user lost 113 BTC worth about $7 million after entering a seed phrase on a fake Trezor website. The site reportedly appeared as a sponsored Google result, turning an ordinary search into the attacker's delivery channel. @SableIndex | @SableIndexDiscussion

🎉 $33x3 🎉

To Participate: • Join @SableIndex • Join @SableIndexOTC • Tap Participate

⬜ Participants: 0 Winners: 3 Giveaway Ends In: 6d 23h 59m

[DEVELOPING · CRIME] More Than 20 Arrested in Russian Crypto-Laundering Crackdown Russian authorities arrested more than 20 people in a crackdown on a network accused of laundering cryptocurrency. The case shows how “just receive and forward the coins” can turn an ordinary wallet into part of a criminal trail. @SableIndex | @SableIndexDiscussion

🎉 33$ 🎉 Hosted By: @sableindex

To Participate: • Join @SableIndex • Join @SableIndexOTC • Add "@sableindex" to your display name • Boost for up to 2x chances • Tap Participate

⬜ ✏️ Lf promoters contact @sableindexmanager Participants: 0 Winners: 3 Giveaway Ends In: 6d 23h 58m

[DEVELOPING · BREACH] Social Engineering Exposes Levi Strauss Corporate Data Levi Strauss disclosed on Aug. 7 that social engineering gave an intruder access to three employees’ company-issued computers. The company says corporate information was accessed and removed, but no consumer data was impacted. Levi Strauss contained the breach and reported no business interruption; its investigation remains ongoing. @SableIndex | @SableIndexDiscussion

[CRIME] St. Louis Trio Charged Over $245M Bitcoin Kidnap Plot Federal prosecutors charged three St. Louis men over an alleged plan to kidnap Veer Chetal. Chetal pleaded guilty after prosecutors tied him to a $245 million Bitcoin theft; the group allegedly wanted his crypto. Prosecutors say the trio stalked his Connecticut family in August 2024, carrying air rifles and walkie-talkies, then fled fearing cameras. @SableIndex | @SableIndexDiscussion